Knowledge Management

Calculate Average for distinct field

splunknewbie420
New Member

I have following data in my splunk results

ReportID Timedelay time Label
123 5 10:00AM Label A
123 10 10:15AM Label A
456 7 10:00AM Label B
456 9 10:03AM LabelB

I am trying to get an average of timedelay per 5 minutes, but I only wanted to get the maximum value of timedelay for each report
so for example I wanted to get average of 10+9 in the above example. Could someone please help me with a query I can use. Appreciate any help and your time. Thanks

0 Karma

somesoni2
Revered Legend

Can you provide the search that is generating the above splunk results? Also, if you want an average of time delay per 5 min with max value of timedelay for each report, for period 10:00AM to 10:05AM, shouldn't you be averaging 5 (for A)+9 (for B)??

0 Karma

dcarmack_splunk
Splunk Employee
Splunk Employee

Give this a try

earliest=-5m@m index=<myindex> sourcetype=<mydata> | fields Timedelay Label | eventstats max(Timedelay) AS max_Timedelay by Label | stats avg(max_Timedelay) AS avg

if you want the same results over a large window of time, you can do this

earliest=-24h index=<myindex> sourcetype=<mydata> | fields Timedelay Label | bucket span=5m __time | eventstats max(Timedelay) AS max_Timedelay by Label _time | stats avg(max_Timedelay) AS avg by _time
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...